ccqa 1.32.0 → 1.33.0

package/dist/bin/ccqa.mjs

@@ -7518,6 +7518,46 @@ z.object({
 	specs: z.record(z.string(), AttestationSchema)
 });
 /**
+* A person's answer to one audit finding: the spec describes the code fine,
+* and the finding is wrong. Where an attestation speaks about the product,
+* this speaks about the *audit* — so it settles the audit axis rather than
+* the verdict, and the spec goes back to being run like any other.
+*
+* Pinned to the audit run whose finding it answers. A later audit is a new
+* observation of newer code, so it produces a new run and this stops
+* applying: the machine gets to raise the finding again, and the record of
+* the last dismissal is shown beside it rather than silently suppressing it.
+* No profile — an audit finding is about the repository, not an environment
+* (ADR-0013), which is also why this is scoped per project alone.
+*/
+const AuditDismissalSchema = z.object({
+	by: z.string().min(1),
+	at: z.string(),
+	note: z.string().min(1),
+	auditRunId: z.string(),
+	label: DriftLabelSchema,
+	headline: z.string()
+});
+/** The per-project dismissal document: "feature/spec" → the last dismissal. */
+const AuditDismissalsSchema = z.object({ specs: z.record(z.string(), AuditDismissalSchema).default({}) });
+/** Body of `PUT /projects/:project/audit-dismissals`. */
+const PutAuditDismissalRequestSchema = z.object({
+	spec: z.string().min(1).max(512),
+	by: z.string().min(1).max(256),
+	note: z.string().min(1).max(4e3)
+});
+/** Body of `DELETE /projects/:project/audit-dismissals`. */
+const DeleteAuditDismissalRequestSchema = z.object({ spec: z.string().min(1).max(512) });
+z.object({
+	project: z.string(),
+	spec: z.string(),
+	dismissal: AuditDismissalSchema
+});
+z.object({
+	project: z.string(),
+	specs: z.record(z.string(), AuditDismissalSchema)
+});
+/**
 * One spec's verdict, the two axes it was derived from, and the three ledger
 * coordinates the view shows alongside them. The coordinates are always
 * present (null when the spec has no such entry); the optional fields appear
@@ -7533,6 +7573,8 @@ const SpecRerunSchema = z.object({
 	execution: ExecutionStateSchema,
 	driftLabel: DriftLabelSchema.exclude(["UNKNOWN"]).optional(),
 	auditAssumedReached: RerunUnknownReasonSchema.optional(),
+	auditDismissed: AuditDismissalSchema.optional(),
+	auditDismissalApplied: z.boolean().optional(),
 	executionAssumedReached: RerunUnknownReasonSchema.optional(),
 	specChangedSince: z.string().optional(),
 	manual: AttestationSchema.optional(),
@@ -9297,6 +9339,20 @@ function connect(opts) {
 	error("hub token is required (--hub-token or CCQA_HUB_TOKEN)");
 	process.exit(2);
 }
+/**
+* The canonical "feature/spec" key for a CLI argument. Hub records are stored
+* and looked up under exactly this form, so an alias accepted here but kept
+* verbatim would silently never match.
+*/
+function requireSpecId(rawSpecId) {
+	try {
+		const parsed = parseSpecPath(rawSpecId);
+		return `${parsed.featureName}/${parsed.specName}`;
+	} catch (err) {
+		error(errMessage(err));
+		process.exit(2);
+	}
+}
 function validateSessionName(name) {
 	const parsed = SessionNameSchema.safeParse(name);
 	if (!parsed.success) {
@@ -9594,14 +9650,7 @@ const pushCommand = new Command("push").description("Upload the report directory
 const attestCommand = new Command("attest").argument("<feature/spec>", "Spec id, e.g. checkout/happy-path").description("Record that a person checked a spec's behaviour by hand against the deployed environment. The verdict answers manuallyVerified instead of asking a person for what a person already did — the drift ledger is untouched, so the repair loop keeps its reason to fix the test. The attestation lapses on its own when a deploy reaches the spec or the spec is edited.").requiredOption("--profile <name>", "Environment that was checked (e.g. 'stg'). The attestation is anchored to its current deploy head.").option("--by <name>", "Who checked. Required unless --revoke.").option("--note <text>", "What was checked and how — the reader deciding whether to trust it sees this.").option("--revoke", "Withdraw the spec's attestation instead of recording one.").option(...hubUrlOption).option(...hubTokenOption).option("--project <name>", "Hub project. Defaults to the current directory's name.").option("--cwd <path>", "Directory the default --project name is resolved against.").action(withHubErrors(async (rawSpecId, opts) => {
 	const project = resolveProject(opts);
 	const hub = connect(opts);
-	let specId;
-	try {
-		const parsed = parseSpecPath(rawSpecId);
-		specId = `${parsed.featureName}/${parsed.specName}`;
-	} catch (err) {
-		error(errMessage(err));
-		process.exit(2);
-	}
+	const specId = requireSpecId(rawSpecId);
 	if (opts.revoke) {
 		await hub.deleteAttestation(project, { profile: opts.profile }, specId);
 		header("hub attest", `${specId} revoked`);
@@ -9621,7 +9670,30 @@ const attestCommand = new Command("attest").argument("<feature/spec>", "Spec id,
 	meta("anchored to deploy", res.attestation.deployedSha ?? "(no deploy log)");
 	info("the verdict answers manuallyVerified until a deploy reaches this spec or the spec is edited");
 }));
-const hubCommand = new Command("hub").description("Client for a ccqa hub: push run results and manage sessions/variables/prompts used by `ccqa run`. See docs/hub.md.").addCommand(pushCommand).addCommand(deployCommand).addCommand(costCommand).addCommand(sessionCommand).addCommand(varCommand).addCommand(promptCommand).addCommand(attestCommand);
+const dismissCommand = new Command("dismiss").argument("<feature/spec>", "Spec id, e.g. checkout/happy-path").description("Record that a person judged the spec's current audit finding wrong: the spec describes the code fine. This settles the audit axis rather than the verdict — the spec goes back to being run like any other, and the next run says whether the person was right. The dismissal is pinned to the audit run that raised the finding, so a later audit can raise it again. No --profile: a finding is about the repository, not an environment.").option("--by <name>", "Who judged it wrong. Required unless --revoke.").option("--reason <text>", "Why the finding is wrong. Required unless --revoke — this is what a mis-firing audit learns from.").option("--revoke", "Withdraw the dismissal, putting the finding back in force.").option(...hubUrlOption).option(...hubTokenOption).option("--project <name>", "Hub project. Defaults to the current directory's name.").option("--cwd <path>", "Directory the default --project name is resolved against.").action(withHubErrors(async (rawSpecId, opts) => {
+	const project = resolveProject(opts);
+	const hub = connect(opts);
+	const specId = requireSpecId(rawSpecId);
+	if (opts.revoke) {
+		await hub.deleteAuditDismissal(project, specId);
+		header("hub dismiss", `${specId} revoked`);
+		return;
+	}
+	if (!opts.by || !opts.reason) {
+		error("--by <name> and --reason <text> are both required: a dismissal is a person's correction, and it needs the person and the correction");
+		process.exit(2);
+	}
+	const res = await hub.putAuditDismissal(project, {
+		spec: specId,
+		by: opts.by,
+		note: opts.reason
+	});
+	header("hub dismiss", specId);
+	meta("by", res.dismissal.by);
+	meta("dismissed", `${res.dismissal.label} — ${res.dismissal.headline || "(no headline)"}`);
+	info("this finding no longer holds the spec back; a later audit can raise one of its own");
+}));
+const hubCommand = new Command("hub").description("Client for a ccqa hub: push run results and manage sessions/variables/prompts used by `ccqa run`. See docs/hub.md.").addCommand(pushCommand).addCommand(deployCommand).addCommand(costCommand).addCommand(sessionCommand).addCommand(varCommand).addCommand(promptCommand).addCommand(attestCommand).addCommand(dismissCommand);
 /** Loose check that a fetched session is agent-browser storage-state, mirroring loadStorageState. */
 function isStorageStateShape(state) {
 	return typeof state === "object" && state !== null && Array.isArray(state.cookies) && Array.isArray(state.origins);
@@ -18929,7 +19001,7 @@ function createGetAuditNeedHandler(storage) {
 //#endregion
 //#region src/hub/api/handlers/locks.ts
 /** A spec-key list and three short strings; nothing here should approach this. */
-const MAX_BODY_BYTES$4 = 1024 * 1024;
+const MAX_BODY_BYTES$5 = 1024 * 1024;
 /**
 * POST /api/v1/projects/:project/locks?profile=
 *
@@ -18943,7 +19015,7 @@ function createAcquireLocksHandler(storage) {
 	return async (ctx) => {
 		const project = requireSafeSegment(ctx.params.project, "project");
 		const profile = requireProfileParam(ctx.url);
-		const body = await readJsonBody(ctx.req, MAX_BODY_BYTES$4, AcquireLocksRequestSchema, "lock request");
+		const body = await readJsonBody(ctx.req, MAX_BODY_BYTES$5, AcquireLocksRequestSchema, "lock request");
 		let result = {
 			granted: [],
 			denied: []
@@ -18972,7 +19044,7 @@ function createReleaseLocksHandler(storage) {
 	return async (ctx) => {
 		const project = requireSafeSegment(ctx.params.project, "project");
 		const profile = requireProfileParam(ctx.url);
-		const body = await readJsonBody(ctx.req, MAX_BODY_BYTES$4, ReleaseLocksRequestSchema, "release request");
+		const body = await readJsonBody(ctx.req, MAX_BODY_BYTES$5, ReleaseLocksRequestSchema, "release request");
 		await storage.locks.update(project, profile, (current) => releaseAll(current, body.holder));
 		ctx.res.writeHead(204).end();
 	};
@@ -18985,7 +19057,7 @@ function createReleaseLocksHandler(storage) {
 * 5000 keys of 256 `\uXXXX`-escaped characters — so a conforming client is
 * never answered 413 by a limit the documented bounds don't mention.
 */
-const MAX_BODY_BYTES$3 = 8 * 1024 * 1024;
+const MAX_BODY_BYTES$4 = 8 * 1024 * 1024;
 function requireAckKey(ctx) {
 	return {
 		project: requireSafeSegment(ctx.params.project, "project"),
@@ -19012,7 +19084,7 @@ function createGetAckHandler(storage) {
 function createPutAckHandler(storage) {
 	return async (ctx) => {
 		const key = requireAckKey(ctx);
-		const body = await readJsonBody(ctx.req, MAX_BODY_BYTES$3, PutAckRequestSchema, "ack body");
+		const body = await readJsonBody(ctx.req, MAX_BODY_BYTES$4, PutAckRequestSchema, "ack body");
 		const ack = await storage.acks.put(key.project, key.profile, key.name, body.keys);
 		sendJson(ctx.res, 200, {
 			...key,
@@ -19023,7 +19095,7 @@ function createPutAckHandler(storage) {
 //#endregion
 //#region src/hub/api/handlers/attestations.ts
 /** Far above the largest body `PutAttestationRequestSchema`'s bounds admit. */
-const MAX_BODY_BYTES$2 = 64 * 1024;
+const MAX_BODY_BYTES$3 = 64 * 1024;
 function requireScope(ctx) {
 	return {
 		project: requireSafeSegment(ctx.params.project, "project"),
@@ -19056,7 +19128,7 @@ function createPutAttestationHandler(storage) {
 	return async (ctx) => {
 		const scope = requireScope(ctx);
 		const [body, head, targets] = await Promise.all([
-			readJsonBody(ctx.req, MAX_BODY_BYTES$2, PutAttestationRequestSchema, "attestation body"),
+			readJsonBody(ctx.req, MAX_BODY_BYTES$3, PutAttestationRequestSchema, "attestation body"),
 			storage.deploys.head(scope.project, scope.profile),
 			requireSpecTargets(storage.perspectives, scope.project, "what can be attested")
 		]);
@@ -19086,7 +19158,7 @@ function createPutAttestationHandler(storage) {
 function createDeleteAttestationHandler(storage) {
 	return async (ctx) => {
 		const scope = requireScope(ctx);
-		const body = await readJsonBody(ctx.req, MAX_BODY_BYTES$2, DeleteAttestationRequestSchema, "attestation body");
+		const body = await readJsonBody(ctx.req, MAX_BODY_BYTES$3, DeleteAttestationRequestSchema, "attestation body");
 		await storage.attestations.update(scope.project, scope.profile, (current) => {
 			const { [body.spec]: _, ...rest } = current.specs;
 			return { specs: rest };
@@ -19095,6 +19167,83 @@ function createDeleteAttestationHandler(storage) {
 	};
 }
 //#endregion
+//#region src/hub/api/handlers/audit-dismissals.ts
+/** Far above the largest body `PutAuditDismissalRequestSchema`'s bounds admit. */
+const MAX_BODY_BYTES$2 = 64 * 1024;
+/**
+* GET /api/v1/projects/:project/audit-dismissals — the raw document,
+* whether or not each entry still answers the spec's current finding. No
+* `?profile=`: a finding is about the repository (see `AuditDismissalSchema`).
+*/
+function createGetAuditDismissalsHandler(storage) {
+	return async (ctx) => {
+		const project = requireSafeSegment(ctx.params.project, "project");
+		const doc = await storage.auditDismissals.get(project);
+		sendJson(ctx.res, 200, {
+			project,
+			specs: doc.specs
+		});
+	};
+}
+/**
+* PUT /api/v1/projects/:project/audit-dismissals — record that a person
+* judged the spec's current audit finding wrong.
+*
+* The finding being answered is read from the ledger rather than taken from
+* the caller: a dismissal must name the run and the label it answers, and
+* only the hub knows which finding is current. A spec with no open finding is
+* a 400 — there is nothing to dismiss, and accepting it would write a record
+* that never applies to anything.
+*
+* The guard stops there on purpose. `/rerun` applies a dismissal only while
+* the audit is also *current* for the profile being asked about, and that is
+* a per-profile question this endpoint has no profile to ask it of (a finding
+* is about the repository, so the dismissal is project-scoped). A dismissal
+* written while a deploy has overtaken the audit is harmless: the next audit
+* supersedes the finding, and the record with it.
+*/
+function createPutAuditDismissalHandler(storage) {
+	return async (ctx) => {
+		const project = requireSafeSegment(ctx.params.project, "project");
+		const [body, ledger] = await Promise.all([readJsonBody(ctx.req, MAX_BODY_BYTES$2, PutAuditDismissalRequestSchema, "dismissal body"), storage.driftLedger.getMerged(project)]);
+		const entry = ledger.specs[body.spec];
+		if (!entry || entry.label === null) throw new HttpError(400, "no_open_finding", `spec "${body.spec}" has no open audit finding in project "${project}" — there is nothing to dismiss`);
+		const dismissal = {
+			by: body.by,
+			at: (/* @__PURE__ */ new Date()).toISOString(),
+			note: body.note,
+			auditRunId: entry.runId,
+			label: entry.label,
+			headline: entry.headline ?? ""
+		};
+		await storage.auditDismissals.update(project, (current) => ({ specs: {
+			...current.specs,
+			[body.spec]: dismissal
+		} }));
+		sendJson(ctx.res, 200, {
+			project,
+			spec: body.spec,
+			dismissal
+		});
+	};
+}
+/**
+* DELETE /api/v1/projects/:project/audit-dismissals — withdraw a dismissal,
+* putting the audit's finding back in force. Deleting one that does not exist
+* is 200: the caller asked for its absence, and it is absent.
+*/
+function createDeleteAuditDismissalHandler(storage) {
+	return async (ctx) => {
+		const project = requireSafeSegment(ctx.params.project, "project");
+		const body = await readJsonBody(ctx.req, MAX_BODY_BYTES$2, DeleteAuditDismissalRequestSchema, "dismissal body");
+		await storage.auditDismissals.update(project, (current) => {
+			const { [body.spec]: _, ...rest } = current.specs;
+			return { specs: rest };
+		});
+		sendJson(ctx.res, 200, { removed: body.spec });
+	};
+}
+//#endregion
 //#region src/hub/api/handlers/spend.ts
 /** One entry is a handful of short fields; anything larger is a malformed client. */
 const MAX_BODY_BYTES$1 = 4 * 1024;
@@ -19167,7 +19316,7 @@ function specMovedSince(changedAt, baselineSha, baselineAt, deployTimes) {
 	return changedAt > (baselineSha && deployTimes.get(baselineSha) || baselineAt) ? changedAt : null;
 }
 function computeRerun(input) {
-	const { specs, ledger, log, touchIndex, drift, locks, attestations, now } = input;
+	const { specs, ledger, log, touchIndex, drift, locks, attestations, dismissals, now } = input;
 	const range = buildRange(log, touchIndex);
 	const deployTimes = deployedAt(log);
 	const out = {};
@@ -19180,6 +19329,9 @@ function computeRerun(input) {
 		let audit = auditState(drift, spec.key, range);
 		let execution = executionState(coords, (sha) => freshness(sha, spec.key, range));
 		const driftEntry = drift.specs[spec.key];
+		const dismissal = dismissals.specs[spec.key];
+		const dismissed = dismissal !== void 0 && driftEntry !== void 0 && dismissal.auditRunId === driftEntry.runId && dismissal.label === driftEntry.label && (audit.audit === "drifted" || audit.audit === "undecided");
+		if (dismissed) audit = { audit: "clean" };
 		const auditMoved = specMovedSince(spec.changedAt, driftEntry?.gitHead ?? null, driftEntry?.at ?? "", deployTimes);
 		const runMoved = specMovedSince(spec.changedAt, coords.lastRun?.deployedSha ?? null, coords.lastRun?.at ?? "", deployTimes);
 		if (auditMoved && audit.audit !== "due") audit = { audit: "due" };
@@ -19193,6 +19345,10 @@ function computeRerun(input) {
 			...auditMoved || runMoved ? { specChangedSince: auditMoved ?? runMoved } : {},
 			...audit,
 			...execution,
+			...dismissal ? {
+				auditDismissed: dismissal,
+				auditDismissalApplied: dismissed
+			} : {},
 			...manualState?.kind === "covers" ? { manual: manualState.attest } : {},
 			...manualState?.kind === "lapsed" ? {
 				manualLapsed: {
@@ -19356,14 +19512,15 @@ function createGetRerunHandler(storage) {
 	return async (ctx) => {
 		const project = requireSafeSegment(ctx.params.project, "project");
 		const profile = requireProfileParam(ctx.url);
-		const [specs, ledger, log, touchIndex, drift, locks, attestations] = await Promise.all([
+		const [specs, ledger, log, touchIndex, drift, locks, attestations, dismissals] = await Promise.all([
 			requireSpecTargets(storage.perspectives, project, "which specs need a re-run"),
 			storage.ledger.getMerged(project, profile),
 			storage.deploys.getLog(project, profile),
 			storage.deploys.getTouchIndex(project, profile),
 			storage.driftLedger.getMerged(project),
 			storage.locks.get(project, profile),
-			storage.attestations.get(project, profile)
+			storage.attestations.get(project, profile),
+			storage.auditDismissals.get(project)
 		]);
 		const head = log.entries[log.entries.length - 1];
 		sendJson(ctx.res, 200, {
@@ -19378,6 +19535,7 @@ function createGetRerunHandler(storage) {
 				drift,
 				locks,
 				attestations,
+				dismissals,
 				now: /* @__PURE__ */ new Date()
 			})
 		});
@@ -20941,6 +21099,12 @@ const CSS = `
   .notebox .nstatus { font-size: 12px; color: var(--muted); }
   .notebox .nstatus.ok { color: var(--pass); }
   .notebox .nstatus.err { color: var(--fail); }
+  /* The inline form an audit-dismissal or environment-attestation button
+     expands into, in place of the two window.prompt() calls this replaces. */
+  .override-form { margin-top: 10px; max-width: 480px; display: flex; flex-direction: column; gap: 10px; }
+  .override-form textarea { width: 100%; min-height: 54px; resize: vertical; font: inherit; font-size: 13px; color: var(--fg-dim); background: var(--surface); border: 1px solid var(--border-strong); border-radius: var(--radius-sm); padding: 8px 10px; }
+  .override-form .of-act { display: flex; align-items: center; gap: 8px; }
+  .override-form .of-hint { font-size: 12px; color: var(--muted); max-width: 62ch; line-height: 1.5; }
 
   @media (max-width: 900px) { .app { grid-template-columns: 1fr; } .sidebar { display: none; } .logo .wm { display: none; } .split { grid-template-columns: 1fr; } .rd-head .meta { margin-left: 0; } }
   @media (max-width: 700px) { .prompt-grid { grid-template-columns: 1fr; } .prompt-diff { grid-template-columns: 1fr; } }
@@ -21113,10 +21277,8 @@ const CLIENT_JS = `
       "perspectives.rerun.noDeployLogBanner": "No deploy has been recorded for profile {profile}, so no case can be judged. Wire ccqa hub deploy record into the deploy job for this environment.",
       "perspectives.rerun.deployHead": "deploy head",
       "perspectives.drift.graded": "confirmed",
-      "perspectives.manual.attestButton": "Mark as manually verified",
       "perspectives.manual.revokeButton": "Revoke manual verification",
-      "perspectives.manual.promptBy": "Who is verifying this?",
-      "perspectives.manual.promptNote": "Note (optional)",
+      "perspectives.manual.envButton": "If the environment issue is resolved, use this",
       "perspectives.manual.confirmRevoke": "Revoke the manual verification for this case?",
       "perspectives.manual.error": "Could not save — retry",
       "perspectives.manual.verifiedBy": "{by} manually verified this ({at})",
@@ -21126,6 +21288,18 @@ const CLIENT_JS = `
       "perspectives.manual.lapsed.specEdited": "the manual verification lapsed when the spec was edited",
       "perspectives.manual.lapsed.newerRed": "the manual verification lapsed after a later run failed",
       "perspectives.manual.lapsed.unrecognized": "the manual verification lapsed for a reason this UI does not recognise",
+      "perspectives.dismiss.offerButton": "If the test spec was fine, use this",
+      "perspectives.dismiss.revokeButton": "Undo the dismissal",
+      "perspectives.dismiss.confirmRevoke": "Undo the dismissal for this case?",
+      "perspectives.dismiss.activeNote": "Audit finding “{headline}” was dismissed by {by} as a false positive ({at}) — “{note}”. The next run will settle it.",
+      "perspectives.dismiss.priorNote": "This finding was previously dismissed by {by} ({at}) — “{note}”.",
+      "perspectives.override.byLabel": "Verified by",
+      "perspectives.override.reasonLabel": "Reason (required)",
+      "perspectives.override.noteLabel": "What was resolved, and how you checked (required)",
+      "perspectives.override.submit": "Record",
+      "perspectives.override.cancel": "Never mind",
+      "perspectives.override.dismissHint": "Overrides the audit finding and closes the case. The verdict moves to “re-run needed”, and the next run settles it.",
+      "perspectives.override.envHint": "The failure stays on record, but the verdict becomes “manually verified” without waiting for a re-run. It lapses once a deploy reaches this spec.",
       "prompt.card.record": "Recording browser actions",
       "prompt.card.live": "Live run (AI-driven)",
       "prompt.card.playwright": "Playwright test generation",
@@ -21293,10 +21467,8 @@ const CLIENT_JS = `
       "perspectives.rerun.noDeployLogBanner": "プロファイル {profile} にデプロイの記録がないため、どのケースも判定できません。この環境のデプロイジョブに ccqa hub deploy record を組み込んでください。",
       "perspectives.rerun.deployHead": "最新デプロイ",
       "perspectives.drift.graded": "人が確認",
-      "perspectives.manual.attestButton": "手動で確認した",
       "perspectives.manual.revokeButton": "手動確認を取り消す",
-      "perspectives.manual.promptBy": "確認者名を入力してください",
-      "perspectives.manual.promptNote": "メモ（任意）",
+      "perspectives.manual.envButton": "環境要因が解消した場合はこちら",
       "perspectives.manual.confirmRevoke": "このケースの手動確認を取り消しますか？",
       "perspectives.manual.error": "保存に失敗しました — 再試行してください",
       "perspectives.manual.verifiedBy": "{by}さんが手動確認（{at}）",
@@ -21306,6 +21478,18 @@ const CLIENT_JS = `
       "perspectives.manual.lapsed.specEdited": "手動確認はspecの編集により失効",
       "perspectives.manual.lapsed.newerRed": "手動確認は直後の実行失敗により失効",
       "perspectives.manual.lapsed.unrecognized": "このUIが認識できない理由により手動確認が失効",
+      "perspectives.dismiss.offerButton": "テスト仕様に問題がなかった場合はこちら",
+      "perspectives.dismiss.revokeButton": "棄却を取り消す",
+      "perspectives.dismiss.confirmRevoke": "このケースの棄却を取り消しますか？",
+      "perspectives.dismiss.activeNote": "監査指摘「{headline}」は{by}が誤検知として棄却（{at}）—「{note}」。次の実行が裁定します。",
+      "perspectives.dismiss.priorNote": "前回この指摘は{by}が棄却しています（{at}）—「{note}」",
+      "perspectives.override.byLabel": "確認した人",
+      "perspectives.override.reasonLabel": "理由（必須）",
+      "perspectives.override.noteLabel": "解消と確認の内容（必須）",
+      "perspectives.override.submit": "記録する",
+      "perspectives.override.cancel": "やめる",
+      "perspectives.override.dismissHint": "監査の指摘を上書きして台帳を閉じます。判定は「要再実行」に移り、次の実行が正否を裁定します。",
+      "perspectives.override.envHint": "失敗の記録は残したまま、判定は再実行を待たず「手動確認済み」になります。次のデプロイがこの spec に届くと失効します。",
       "prompt.card.record": "ブラウザ操作の記録",
       "prompt.card.live": "ライブ実行（AI操作）",
       "prompt.card.playwright": "Playwrightテスト生成",
@@ -23403,6 +23587,13 @@ const CLIENT_JS = `
       "/attestations?profile=" + encodeURIComponent(state.profile);
   }
 
+  // A person's answer to an audit finding, not an environment: the finding is
+  // about the repository, not a deployed profile, so this carries no
+  // ?profile= (unlike attestationsPath above).
+  function auditDismissalsPath() {
+    return "/api/v1/projects/" + encodeURIComponent(state.project) + "/audit-dismissals";
+  }
+
   // Resolves { report } or { note } and never rejects: a hub that predates
   // the endpoint costs only the columns it feeds, not the whole tab. A 404
   // here can only mean "no such route" — the endpoint's own 404 is "the
@@ -24056,28 +24247,80 @@ const CLIENT_JS = `
   }
   // --- end pure: rerun detail labels ----------------------------------------
 
+  // --- pure: audit dismissal reading ----------------------------------------
+  // Self-contained (no DOM, no closures) for the same reason as the regions
+  // above: read rr.auditDismissed against rr.audit, per the schema's own
+  // comment on the field. "clean" means the dismissal is what is holding the
+  // axis there; "drifted"/"undecided" means a later audit re-raised what it
+  // answered, so the old dismissal no longer covers it.
+  // The audit has something outstanding on this spec. Both values mean the
+  // same thing to a reader deciding whether to answer it: the audit read the
+  // code and did not clear the spec (ADR-0019).
+  function auditOpen(rr) {
+    return !!rr && (rr.audit === "drifted" || rr.audit === "undecided");
+  }
+  function auditDismissalActive(rr) {
+    // The hub says whether the dismissal settled the axis. Inferring it from
+    // "clean" would credit the person for a later audit clearing the spec on
+    // its own, which reads identically here.
+    return !!(rr && rr.auditDismissed && rr.auditDismissalApplied);
+  }
+  function auditDismissalReflagged(rr) {
+    return !!(rr && rr.auditDismissed && auditOpen(rr));
+  }
+  // --- end pure: audit dismissal reading -------------------------------------
+
+  // The dismissal's own words, read against the current audit state: active,
+  // it explains why the axis reads clean; re-flagged, it is a fact worth
+  // keeping visible beside the finding that reopened it.
+  function rerunDismissalLine(rr) {
+    if (!rr || !rr.auditDismissed) return null;
+    var d = rr.auditDismissed;
+    if (auditDismissalActive(rr)) {
+      return {
+        muted: false,
+        text: t("perspectives.dismiss.activeNote")
+          .replace("{headline}", d.headline).replace("{by}", d.by).replace("{at}", relTime(d.at)).replace("{note}", d.note),
+      };
+    }
+    if (auditDismissalReflagged(rr)) {
+      return {
+        muted: true,
+        text: t("perspectives.dismiss.priorNote")
+          .replace("{by}", d.by).replace("{at}", relTime(d.at)).replace("{note}", d.note),
+      };
+    }
+    return null;
+  }
+
   // The evidence behind the verdict, as the value of whichever row
   // rerunEvidenceLabelKey chose. For needed/notNeeded that is what the deploy
   // log holds since this case last ran, named by rerunChangeLine.
   // The label already states the timeframe, so the value never repeats it.
+  // A dismissal (active or superseded by a later finding) is appended below
+  // whichever of those this case has, rather than replacing it — see
+  // rerunDismissalLine.
   function rerunEvidenceValue(rr) {
     var wrap = el("div");
     if (!rerunHasEvidence(rr)) {
       wrap.appendChild(el("div", "d-prose", rerunWhyVerdict(rr)));
-      return wrap;
-    }
-    // Both states require a non-empty deploy log, so a head-less report
-    // contradicts itself; rerunChangeLine then names what is missing rather
-    // than inventing a baseline.
-    var line = rerunChangeLine(rr, perspState.rerun && perspState.rerun.deployHead);
-    var text = t(line.key).replace("{sha}", shortSha(line.sha));
-    if (line.at) text += " · " + relTime(line.at);
-    wrap.appendChild(el("div", "d-prose", text));
-    // A touch the index proved but cannot enumerate leaves no paths to list;
-    // the line above still says a change landed, which is all that is known.
-    if (rr.verdict === "rerunNeeded" && rr.touchedBy && rr.touchedBy.length) {
-      wrap.appendChild(pathCodes(rr.touchedBy));
+    } else {
+      // Both states require a non-empty deploy log, so a head-less report
+      // contradicts itself; rerunChangeLine then names what is missing rather
+      // than inventing a baseline.
+      var line = rerunChangeLine(rr, perspState.rerun && perspState.rerun.deployHead);
+      var text = t(line.key).replace("{sha}", shortSha(line.sha));
+      if (line.at) text += " · " + relTime(line.at);
+      wrap.appendChild(el("div", "d-prose", text));
+      // A touch the index proved but cannot enumerate leaves no paths to
+      // list; the line above still says a change landed, which is all that
+      // is known.
+      if (rr.verdict === "rerunNeeded" && rr.touchedBy && rr.touchedBy.length) {
+        wrap.appendChild(pathCodes(rr.touchedBy));
+      }
     }
+    var dismissLine = rerunDismissalLine(rr);
+    if (dismissLine) wrap.appendChild(el("div", "d-prose" + (dismissLine.muted ? " muted" : ""), dismissLine.text));
     return wrap;
   }
 
@@ -24096,9 +24339,7 @@ const CLIENT_JS = `
     return wrap;
   }
 
-  // Lets a person's own check stand in for the machine's verdict. prompt()/
-  // confirm() rather than a form: the action is rare and the two fields it
-  // needs are short, so a modal would outweigh what it does. reloadRerun()
+  // Lets a person's own check stand in for the machine's verdict. reloadRerun()
   // is the same profile-scoped refresh a profile switch uses — it re-renders
   // the whole table, so an open detail panel closes along with it.
   function submitAttestation(method, body) {
@@ -24110,17 +24351,16 @@ const CLIENT_JS = `
       .catch(function (err) { window.alert(t("perspectives.manual.error") + ": " + err.message); });
   }
 
-  function manualAttestButton(feature, spec) {
-    var btn = el("button", "btn sm primary", t("perspectives.manual.attestButton"));
-    btn.type = "button";
-    btn.addEventListener("click", function () {
-      var by = window.prompt(t("perspectives.manual.promptBy"), loadAttestBy());
-      if (!by) return;
-      storeAttestBy(by);
-      var note = window.prompt(t("perspectives.manual.promptNote"), "");
-      submitAttestation("PUT", { spec: perspSpecKey(feature, spec), by: by, note: note || undefined });
-    });
-    return btn;
+  // Lets a person say an audit finding was wrong. Same reload contract as
+  // submitAttestation above; a different endpoint (no ?profile=, ADR: a
+  // finding is about the repository).
+  function submitAuditDismissal(method, body) {
+    apiFetch(auditDismissalsPath(), {
+      method: method,
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body),
+    }).then(function () { reloadRerun(); })
+      .catch(function (err) { window.alert(t("perspectives.manual.error") + ": " + err.message); });
   }
 
   function manualRevokeButton(feature, spec) {
@@ -24133,6 +24373,120 @@ const CLIENT_JS = `
     return btn;
   }
 
+  function auditDismissalRevokeButton(feature, spec) {
+    var btn = el("button", "btn ghost sm del", t("perspectives.dismiss.revokeButton"));
+    btn.type = "button";
+    btn.addEventListener("click", function () {
+      if (!window.confirm(t("perspectives.dismiss.confirmRevoke"))) return;
+      submitAuditDismissal("DELETE", { spec: perspSpecKey(feature, spec) });
+    });
+    return btn;
+  }
+
+  // The inline form a "dismiss" or "environment" offer button expands into,
+  // in place of the two window.prompt() calls this replaces. Both kinds ask
+  // for the same two things — who, and why — and differ only in wording and
+  // which endpoint the answer goes to.
+  function buildOverrideForm(kind, feature, spec, onCancel) {
+    var wrap = el("div", "override-form");
+
+    var byRow = el("div", "form-row");
+    byRow.appendChild(el("label", null, t("perspectives.override.byLabel")));
+    var byInput = el("input", "input");
+    byInput.type = "text";
+    byInput.value = loadAttestBy();
+    byRow.appendChild(byInput);
+    wrap.appendChild(byRow);
+
+    var noteRow = el("div", "form-row");
+    noteRow.appendChild(el("label", null, t(kind === "dismiss" ? "perspectives.override.reasonLabel" : "perspectives.override.noteLabel")));
+    var noteInput = el("textarea");
+    noteRow.appendChild(noteInput);
+    wrap.appendChild(noteRow);
+
+    var act = el("div", "of-act");
+    var submitBtn = el("button", "btn sm primary", t("perspectives.override.submit"));
+    submitBtn.type = "button";
+    submitBtn.disabled = true;
+    var cancelBtn = el("button", "btn ghost sm", t("perspectives.override.cancel"));
+    cancelBtn.type = "button";
+    act.appendChild(submitBtn);
+    act.appendChild(cancelBtn);
+    wrap.appendChild(act);
+
+    wrap.appendChild(el("div", "of-hint", t(kind === "dismiss" ? "perspectives.override.dismissHint" : "perspectives.override.envHint")));
+
+    function syncEnabled() {
+      submitBtn.disabled = !(byInput.value.trim() && noteInput.value.trim());
+    }
+    byInput.addEventListener("input", syncEnabled);
+    noteInput.addEventListener("input", syncEnabled);
+    cancelBtn.addEventListener("click", onCancel);
+
+    submitBtn.addEventListener("click", function () {
+      var by = byInput.value.trim();
+      var note = noteInput.value.trim();
+      if (!by || !note) return;
+      storeAttestBy(by);
+      if (kind === "dismiss") submitAuditDismissal("PUT", { spec: perspSpecKey(feature, spec), by: by, note: note });
+      else submitAttestation("PUT", { spec: perspSpecKey(feature, spec), by: by, note: note });
+    });
+
+    return wrap;
+  }
+
+  // A button that expands into buildOverrideForm above in place, rather than
+  // a modal — the action is rare enough that swapping the button for its own
+  // form reads fine without one.
+  function buildOverrideOffer(kind, feature, spec) {
+    var box = el("div", "manual-attest");
+    var openBtn = el("button", "btn sm primary", t(kind === "dismiss" ? "perspectives.dismiss.offerButton" : "perspectives.manual.envButton"));
+    openBtn.type = "button";
+    box.appendChild(openBtn);
+    openBtn.addEventListener("click", function () {
+      box.removeChild(openBtn);
+      var form = buildOverrideForm(kind, feature, spec, function () {
+        box.removeChild(form);
+        box.appendChild(openBtn);
+      });
+      box.appendChild(form);
+    });
+    return box;
+  }
+
+  // The audit-axis override slot: dismiss an open finding, or revoke a
+  // dismissal that is currently the reason the axis reads clean. At most one
+  // of the two ever shows — a finding the axis
+  // itself has cleared, dismissed or not, offers nothing here.
+  function auditOverrideBox(feature, spec, rr) {
+    if (auditDismissalActive(rr)) {
+      var box = el("div", "manual-attest");
+      box.appendChild(auditDismissalRevokeButton(feature, spec));
+      return box;
+    }
+    if (auditOpen(rr)) return buildOverrideOffer("dismiss", feature, spec);
+    return null;
+  }
+
+  // The execution-axis override slot: revoke a standing attestation, or offer
+  // one for an environment-caused failure — but only when the audit axis has
+  // no open finding of its own, which is auditOverrideBox's problem to answer,
+  // not this one's.
+  function executionOverrideBox(feature, spec, rr) {
+    if (rr.manual) {
+      var box = el("div", "manual-attest");
+      if (rr.verdict !== "manuallyVerified") box.appendChild(el("div", "d-prose", manualAttestationText(rr.manual)));
+      box.appendChild(manualRevokeButton(feature, spec));
+      return box;
+    }
+    // Only once the audit has actually cleared the spec: while it is still
+    // due, nobody knows yet whether the environment was the only thing wrong.
+    if (rr.audit === "clean" && rr.execution === "failed" && rr.lastRed && rr.lastRed.label === "ENVIRONMENT") {
+      return buildOverrideOffer("environment", feature, spec);
+    }
+    return null;
+  }
+
   // Detail row: a definition list of the case's fields plus the note editor.
   // Built with createElement/textContent throughout — every field here is
   // API-derived, so none of it may go through innerHTML.
@@ -24190,22 +24544,14 @@ const CLIENT_JS = `
       frag.appendChild(stepsBox);
     }
 
-    // A standing attestation always offers revoke — even when it changed
-    // nothing (a held or machine-verified spec), it exists and must stay
-    // findable. A lapsed one is named right here, beside the attest button
-    // the reader is deciding whether to press.
-    var manualBtn = null;
-    if (rr && rr.manual) manualBtn = manualRevokeButton(feature, spec);
-    else if (rr && (rr.verdict === "needsRepair" || rr.verdict === "rerunNeeded")) manualBtn = manualAttestButton(feature, spec);
-    if (manualBtn) {
-      var manualBox = el("div", "manual-attest");
-      if (rr.manual && rr.verdict !== "manuallyVerified") {
-        manualBox.appendChild(el("div", "d-prose", manualAttestationText(rr.manual)));
-      }
-      var lapseLine = rerunManualLapseText(rr);
-      if (lapseLine) manualBox.appendChild(el("div", "d-prose", lapseLine));
-      manualBox.appendChild(manualBtn);
-      frag.appendChild(manualBox);
+    // A person's override, always at most one control per axis: which finding
+    // is open decides whether that slot offers a new override or revokes a
+    // standing one (auditOverrideBox / executionOverrideBox).
+    if (rr) {
+      var auditBox = auditOverrideBox(feature, spec, rr);
+      if (auditBox) frag.appendChild(auditBox);
+      var execBox = executionOverrideBox(feature, spec, rr);
+      if (execBox) frag.appendChild(execBox);
     }
 
     var notebox = el("div", "notebox");
@@ -25502,6 +25848,9 @@ function registerRoutes(router, config, queue) {
 	router.get("/api/v1/projects/:project/attestations", createGetAttestationsHandler(storage));
 	router.put("/api/v1/projects/:project/attestations", createPutAttestationHandler(storage));
 	router.delete("/api/v1/projects/:project/attestations", createDeleteAttestationHandler(storage));
+	router.get("/api/v1/projects/:project/audit-dismissals", createGetAuditDismissalsHandler(storage));
+	router.put("/api/v1/projects/:project/audit-dismissals", createPutAuditDismissalHandler(storage));
+	router.delete("/api/v1/projects/:project/audit-dismissals", createDeleteAuditDismissalHandler(storage));
 	router.get("/api/v1/projects/:project/acks/:name", createGetAckHandler(storage));
 	router.put("/api/v1/projects/:project/acks/:name", createPutAckHandler(storage));
 	router.post("/api/v1/projects/:project/spend", createRecordSpendHandler(storage));
@@ -25794,6 +26143,9 @@ function specLocksPath(root, project, profile) {
 function attestationsPath(root, project, profile) {
 	return join(root, "attestations", project, profile, "attestations.json");
 }
+function auditDismissalsPath(root, project) {
+	return join(root, "audit-dismissals", `${project}.json`);
+}
 function ackPath(root, project, profile, name) {
 	return join(root, "acks", project, profile, `${name}.json`);
 }
@@ -25851,6 +26203,22 @@ function createFileAttestationStore(root) {
 	};
 }
 //#endregion
+//#region src/hub/core/storage/file/audit-dismissal-store.ts
+function toDismissals(doc) {
+	const parsed = AuditDismissalsSchema.safeParse(doc);
+	return parsed.success ? parsed.data : { specs: {} };
+}
+function createFileAuditDismissalStore(root) {
+	return {
+		async get(project) {
+			return toDismissals(await readJson(auditDismissalsPath(root, project)));
+		},
+		async update(project, mutate) {
+			return updateJson(auditDismissalsPath(root, project), (current) => mutate(toDismissals(current)));
+		}
+	};
+}
+//#endregion
 //#region src/hub/core/storage/file/artifact-store.ts
 /**
 * Defense-in-depth: `relPath` is expected to already be validated by the
@@ -26335,7 +26703,8 @@ function createFileHubStorage(dataDir) {
 		locks: createFileLockStore(dataDir),
 		acks: createFileAckStore(dataDir),
 		spend: createFileSpendStore(dataDir),
-		attestations: createFileAttestationStore(dataDir)
+		attestations: createFileAttestationStore(dataDir),
+		auditDismissals: createFileAuditDismissalStore(dataDir)
 	};
 }
 //#endregion

package/dist/hub-client/index.d.mts

@@ -237,6 +237,39 @@ declare const AttestationsResponseSchema: z.ZodObject<{
   }, z.core.$strip>>;
 }, z.core.$strip>;
 type AttestationsResponse = z.infer<typeof AttestationsResponseSchema>;
+declare const AuditDismissalResponseSchema: z.ZodObject<{
+  project: z.ZodString;
+  spec: z.ZodString;
+  dismissal: z.ZodObject<{
+    by: z.ZodString;
+    at: z.ZodString;
+    note: z.ZodString;
+    auditRunId: z.ZodString;
+    label: z.ZodEnum<{
+      TEST_DRIFT: "TEST_DRIFT";
+      SPEC_CHANGE: "SPEC_CHANGE";
+      UNKNOWN: "UNKNOWN";
+    }>;
+    headline: z.ZodString;
+  }, z.core.$strip>;
+}, z.core.$strip>;
+type AuditDismissalResponse = z.infer<typeof AuditDismissalResponseSchema>;
+declare const AuditDismissalsResponseSchema: z.ZodObject<{
+  project: z.ZodString;
+  specs: z.ZodRecord<z.ZodString, z.ZodObject<{
+    by: z.ZodString;
+    at: z.ZodString;
+    note: z.ZodString;
+    auditRunId: z.ZodString;
+    label: z.ZodEnum<{
+      TEST_DRIFT: "TEST_DRIFT";
+      SPEC_CHANGE: "SPEC_CHANGE";
+      UNKNOWN: "UNKNOWN";
+    }>;
+    headline: z.ZodString;
+  }, z.core.$strip>>;
+}, z.core.$strip>;
+type AuditDismissalsResponse = z.infer<typeof AuditDismissalsResponseSchema>;
 /** Body of `GET /projects/:project/audit-needed?profile=`: one answer per spec. */
 declare const AuditNeedReportSchema: z.ZodObject<{
   project: z.ZodString;
@@ -303,6 +336,19 @@ declare const RerunReportSchema: z.ZodObject<{
       deployedShaNotInLog: "deployedShaNotInLog";
       gapInRange: "gapInRange";
     }>>;
+    auditDismissed: z.ZodOptional<z.ZodObject<{
+      by: z.ZodString;
+      at: z.ZodString;
+      note: z.ZodString;
+      auditRunId: z.ZodString;
+      label: z.ZodEnum<{
+        TEST_DRIFT: "TEST_DRIFT";
+        SPEC_CHANGE: "SPEC_CHANGE";
+        UNKNOWN: "UNKNOWN";
+      }>;
+      headline: z.ZodString;
+    }, z.core.$strip>>;
+    auditDismissalApplied: z.ZodOptional<z.ZodBoolean>;
     executionAssumedReached: z.ZodOptional<z.ZodEnum<{
       noSelectionInRange: "noSelectionInRange";
       selectionUnknown: "selectionUnknown";
@@ -1070,6 +1116,20 @@ interface HubClient {
   deleteAttestation(project: string, q: {
     profile: string;
   }, spec: string): Promise<void>;
+  /** Every dismissed audit finding for the project, current and superseded alike. No profile — findings are about the repository. */
+  getAuditDismissals(project: string): Promise<AuditDismissalsResponse>;
+  /**
+   * Record that a person judged `spec`'s current audit finding wrong. The hub
+   * reads which finding that is from the ledger and pins the dismissal to it;
+   * a spec with no open finding is rejected.
+   */
+  putAuditDismissal(project: string, body: {
+    spec: string;
+    by: string;
+    note: string;
+  }): Promise<AuditDismissalResponse>;
+  /** Withdraw a dismissal, putting the audit's finding back in force. */
+  deleteAuditDismissal(project: string, spec: string): Promise<void>;
   /**
    * Every spec's last `ccqa audit --report-to-hub` result, keyed by "feature/spec". No
    * profile — drift asks whether a spec still describes the code, not

package/dist/hub-client/index.mjs

@@ -199,6 +199,23 @@ function createHubClient(opts) {
 				body: JSON.stringify({ spec })
 			});
 		},
+		getAuditDismissals(project) {
+			return json(auditDismissalsPath(project));
+		},
+		putAuditDismissal(project, body) {
+			return json(auditDismissalsPath(project), {
+				method: "PUT",
+				headers: { "Content-Type": "application/json" },
+				body: JSON.stringify(body)
+			});
+		},
+		async deleteAuditDismissal(project, spec) {
+			await request(auditDismissalsPath(project), {
+				method: "DELETE",
+				headers: { "Content-Type": "application/json" },
+				body: JSON.stringify({ spec })
+			});
+		},
 		getAuditNeed(project, q) {
 			return json(`/api/v1/projects/${encodeURIComponent(project)}/audit-needed?${queryString({ profile: q.profile })}`);
 		},
@@ -325,6 +342,9 @@ function locksPath(project) {
 function attestationsPath(project) {
 	return `/api/v1/projects/${encodeURIComponent(project)}/attestations`;
 }
+function auditDismissalsPath(project) {
+	return `/api/v1/projects/${encodeURIComponent(project)}/audit-dismissals`;
+}
 /** Perspectives are one document per project: `/api/v1/projects/<project>/perspectives`. */
 function perspectivesPath(project) {
 	return `/api/v1/projects/${encodeURIComponent(project)}/perspectives`;

package/dist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccqa",
-  "version": "1.32.0",
+  "version": "1.33.0",
   "type": "module",
   "description": "Browser test recorder powered by Claude Code and agent-browser",
   "repository": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccqa",
-  "version": "1.32.0",
+  "version": "1.33.0",
   "type": "module",
   "description": "Browser test recorder powered by Claude Code and agent-browser",
   "repository": {